topic Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465382#M80240 <P>We had this severe issue last week - <A href="https://answers.splunk.com/answers/799788/what-can-be-done-when-the-parsing-and-aggregation.html">What can be done when the parsing and aggregation queues are filled up?</A></P> <P>Since it took us days to figure it out and the entire indexer cluster was compromised and it took 11 hours with Support on the line to detect it, I wonder whether in general an heavy forwarder layer is a good idea.</P> Wed, 12 Feb 2020 02:45:14 GMT danielbb 2020-02-12T02:45:14Z Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers? https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465382#M80240 <P>We had this severe issue last week - <A href="https://answers.splunk.com/answers/799788/what-can-be-done-when-the-parsing-and-aggregation.html">What can be done when the parsing and aggregation queues are filled up?</A></P> <P>Since it took us days to figure it out and the entire indexer cluster was compromised and it took 11 hours with Support on the line to detect it, I wonder whether in general an heavy forwarder layer is a good idea.</P> Wed, 12 Feb 2020 02:45:14 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465382#M80240 danielbb 2020-02-12T02:45:14Z Re: Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers? https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465383#M80241 <P>Hi @danielbb,<BR /> I use HFs only when I need them (separated networks or syslogs), if I can I prefer to directly send logs from UFs to Indexers.</P> <P>Maybe you should understand (with Support help) why you had the above problem, I don't think that an additional HF's layer could solve your problem, probably it could generate more queue problems.</P> <P>Ciao.<BR /> Giuseppe</P> Wed, 12 Feb 2020 12:46:12 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465383#M80241 gcusello 2020-02-12T12:46:12Z Re: Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers? https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465384#M80242 <P>What problem are you trying to solve by adding a heavy forwarder environment?</P> Wed, 12 Feb 2020 13:05:01 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465384#M80242 mydog8it 2020-02-12T13:05:01Z Re: Should we use heavy forwarders as an intermediate layer between the forwarders and the indexers? https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465385#M80243 <P>Reducing load on the indexers and isolating issues as I pointed to in the question... </P> Thu, 13 Feb 2020 17:43:53 GMT https://community.splunk.com/t5/Getting-Data-In/Should-we-use-heavy-forwarders-as-an-intermediate-layer-between/m-p/465385#M80243 danielbb 2020-02-13T17:43:53Z